First-run password is in data/_bootstrap (also shown once after deploy). Change it in Settings after login.